CVE-2026-85212 CRMEB through 6.0.0 Missing Authorization via Inert verifyAuth Role Check

CRMEB contains an authentication bypass vulnerability in the verifyAuth method of SystemRoleServices.php that returns true from both conditional branches. Sub-administrators and accounts with no roles can access restricted admin endpoints by exploiting the inert role check that always permits...

MAL-2026-12322 Malicious code in @mgor/fw-canary-3333 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6b82e18fdadfd37a1622c522a7ca4e9ae7772b266175123dfabb8d90e3950ef6 On require of @mgor/fw-canary-3333, index.js executes a top-level shell command that curls https://fewafw.hydege.me and pipes the response into...

EUVD-2026-46034

Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.12.2, EnvironmentManager.listBackups reads each backup's manifest.json and trusts the manifest's path field. EnvironmentManager.pruneBackups later passes that trusted entry.path directly to rmSyncentry.path, recursive...

Malicious Package

Overview vybscan-testbed-inert-postinstall is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and...

CVE-2026-48049

@hapi/inert provides static file and directory handlers for hapi.js. From 4.0.0 to 7.1.0, @hapi/inert serves static files from a directory configured with path in the directory or file handlers or relativeTo for h.file, with confinement enforced by the confine option, but the confinement check...

CVE-2026-48049 @hapi/inert: Static-file confinement bypass via sibling-prefix path

@hapi/inert provides static file and directory handlers for hapi.js. From 4.0.0 to 7.1.0, @hapi/inert serves static files from a directory configured with path in the directory or file handlers or relativeTo for h.file, with confinement enforced by the confine option, but the confinement check...

CVE-2026-48049

@hapi/inert provides static file and directory handlers for hapi.js. From 4.0.0 to 7.1.0, @hapi/inert serves static files from a directory configured with path in the directory or file handlers or relativeTo for h.file, with confinement enforced by the confine option, but the confinement check...

CVE-2026-48049 @hapi/inert: Static-file confinement bypass via sibling-prefix path

@hapi/inert provides static file and directory handlers for hapi.js. From 4.0.0 to 7.1.0, @hapi/inert serves static files from a directory configured with path in the directory or file handlers or relativeTo for h.file, with confinement enforced by the confine option, but the confinement check...

EUVD-2026-45341

@hapi/inert provides static file and directory handlers for hapi.js. From 4.0.0 to 7.1.0, @hapi/inert serves static files from a directory configured with path in the directory or file handlers or relativeTo for h.file, with confinement enforced by the confine option, but the confinement check...

CVE-2026-48049 @hapi/inert: Static-file confinement bypass via sibling-prefix path

@hapi/inert provides static file and directory handlers for hapi.js. From 4.0.0 to 7.1.0, @hapi/inert serves static files from a directory configured with path in the directory or file handlers or relativeTo for h.file, with confinement enforced by the confine option, but the confinement check...

CVE-2026-48049

The CVE-2026-48049 issue affects @hapi/inert (versions 4.0.0–7.1.0). A confinement bypass was caused by a flawed raw string-prefix path check, allowing an unauthenticated remote attacker to read files via traversal (e.g., /..%2fstatic-secret/secret.txt). The vulnerability is mitigated by upgradin...

CVE-2026-48049

@hapi/inert provides static file and directory handlers for hapi.js. From 4.0.0 to 7.1.0, @hapi/inert serves static files from a directory configured with path in the directory or file handlers or relativeTo for h.file, with confinement enforced by the confine option, but the confinement check...

CVE-2026-48049: Improper Limitation of a Pathname to a Restricted Directory

@hapi/inert provides static file and directory handlers for hapi.js. From 4.0.0 to 7.1.0, @hapi/inert serves static files from a directory configured with path in the directory or file handlers or relativeTo for h.file, with confinement enforced by the confine option, but the confinement check...

ROOT-APP-NPM-CVE-2026-48049 CVE-2026-48049 in @rootio/hapi__inert - Patched by Root

Root has patched CVE-2026-48049 in the @rootio/hapiinert package for Root:npm. Multiple fixed versions available...

3id-test-helper (>=1.0.0, <=1.0.4), 3nit-utils (>=0.24.0, <=1.0.2) +311 more potentially affected by CVE-2026-48049 via @hapi/inert (>=5.2.0, <=7.1.0)

@hapi/inert NPM version =5.2.0, =1.0.0, =0.24.0, =3.0.0-beta.1, =4.0.0, =0.9.0, =0.1.0, =1.0.1, =0.9.139, =5.0.0-ayFork-1.0.16, =3.0.0, =6.1.0, =0.0.2, =0.11.0, =9.0.0 and more Source cves: CVE-2026-48049 Source advisory: OSV:GHSA-RCVQ-M9J9-6F4G...

Directory Traversal

Overview @hapi/inert is a Static file and directory handlers plugin for hapi.js Affected versions of this package are vulnerable to Directory Traversal via the confine option. An unauthenticated remote attacker can access files outside the intended directory by crafting requests that exploit...

@iotfactory/poetry (>=0.7.1-alpha.12, <=0.11.3), @mojaloop/als-consent-oracle (>=1.1.0, <=1.1.7) +22 more potentially affected by CVE-2026-48049 via @hapi/inert (>=7.0.0, <=7.1.0)

@hapi/inert NPM version =7.0.0, =0.7.1-alpha.12, =1.1.0, =15.2.0, =17.1.6, =15.2.0-snapshot.0, =0.1.11, =0.9.0, =15.5.0-iso.0, =17.1.0, =2.60.1, =14.1.0, =0.9.0, =2.0.3, =2.2.2 - microkernel-mod-graphqlio 1.9.1 and more Source cves: CVE-2026-48049 Source advisory: SNYK:JS-HAPIINERT-17337031...

GHSA-RCVQ-M9J9-6F4G @hapi/inert has a static-file confinement bypass via sibling-prefix path

Impact @hapi/inert serves static files from a directory configured with path in the directory / file handlers or relativeTo for h.file, with confinement enforced by the confine option default true. Before the patch, the confinement check compared the resolved absolute path against the confine...

@hapi/inert has a static-file confinement bypass via sibling-prefix path

Impact @hapi/inert serves static files from a directory configured with path in the directory / file handlers or relativeTo for h.file, with confinement enforced by the confine option default true. Before the patch, the confinement check compared the resolved absolute path against the confine...

3id-test-helper (>=1.0.0, <=1.0.4), 3nit-utils (>=0.24.0, <=1.0.2) +311 more potentially affected by CVE-2026-48049 via @hapi/inert (>=5.2.0, <=7.1.0)

@hapi/inert NPM version =5.2.0, =1.0.0, =0.24.0, =3.0.0-beta.1, =4.0.0, =0.9.0, =0.1.0, =1.0.1, =0.9.139, =5.0.0-ayFork-1.0.16, =3.0.0, =6.1.0, =0.0.2, =0.11.0, =9.0.0 and more Source cves: CVE-2026-48049 Source advisory: GHSA-RCVQ-M9J9-6F4G...